Slashdot Mirror
Researchers Infiltrate and 'Pollute' Storm Botnet
ancientribe writes "Dark Reading reports that a group of European researchers has found a way to disrupt the massive Storm botnet by infiltrating it and injecting "polluted" content into it to disrupt communication among the bots and their controlling hosts. Other researchers have historically shied way from this controversial method because they don't "want to mess with other peoples' PCs by injecting commands," said one botnet expert quoted in the article.
Add free article here.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Even though I agree with you on the second half of the comment I still think you are spreading FUD with the first part.. 1) "Researchers" don't "just" send the polluted hashes to the bots in hopes of it to disrupt communications. 2) They aren't "fuzzing" the bots looking for a vulnerability, that will disrupt a command channel and possibly crash a bot completely. That would be extremely irresponsible. 3) "Researchers" analyze the bot software localy in order to determine the correct hash strings to figure out the way to disrupt communication 4) obviously the 'attackers' can introduce a back process in to their bot software that would destroy the bot image and OS completely if such control channel disruption is detected, however it's pointless since the bot is out of the commission anyway.
TFA states that they are changing the hash values that the bots use to talk to one another. They aren't issuing commands, they're interrupting the communication of the bots.
If you RTFA, they are not sending any commands to the end computer. They are just disrupting communications between the nodes.
Effectively, fracturing the net into multiple pieces; not taking control o the computers and doing something.
This is not a counter-attack to the infection or anything like that. They're just jamming the comm system that the bots use. They're not actively doing anything to the bot or computer.
To the ones worried about the ethics, at least in this case: What the researchers did, in a sense, is change the 'name' and/or 'password' the bot uses to call the bot master and authenticate itself. In short, they removed the ability of the 'bot to get more commands.
V for Vendetta: People should not be afraid of their governments. Governments should be afraid of their people.
Actually, if I'm not mistaken, TFA claims that the researchers are using those exact vectors to do their counterattacks. As in, they mess with the encryption key so that any data that comes in from the controllers or other bots will be reported as bogus due to the controller/bot keys not matching. This, in a large way, renders the bot harmless, as it will now ignore all orders, expecting something signed by a key that will never arrive.
It's honestly a clever way to pull it off, though it does open the door to a malicious someone planting a legitimate key to someone else's commands, assuming it's as easy as the researchers seem to indicate to plant a bogus one. Or re-attacking the machine to put a Storm key back in.
Demanding constant attention will only lead to attention.
Mod points are not supposed to be used as "I agree".
Since your ./ ID is over the million, you must be new here and, in a grand welcoming gesture of mine, I will share this Slashdot secret with you.
RTFA=Read The Fucking Article.
In many states you can be sued for improperly providing CPR. In fact, it happens quite a lot.
moox. for a new generation.
Actually, the paper presented at the conference
http://www.usenix.org/event/leet08/tech/full_papers/holz/holz_html/mentions that the fracturing attack does not work. The Storm botnet currently only 2 things.
1. It sends spam e-mails if it receives a file in a spam template format with another file containing a list of addresses.
2. It commits a denial-of-service attack against a host if it receives a different templated file.
What the researchers are proposing is to become a sender and to send out floods of blank files faster than the actual operators can send out their real files. As a result, the hosts are too busy downloading the 2200 phony files to get around to the 1 real one.
The time it takes for all the network nodes to get around to the real file eliminates the power of the botnet, reducing its effectiveness to that of a few machines even if it contains tens of thousands.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
No, they're changing the key. Essentially you're decoupling the node. Everything is there, it's just the password for that particular node of the botnet is reset. That doesn't change the fact that the ability to execute malicious code is still there and if anyone tracked the keys that were used to overwrite that of the botnets, they could set up their own network.
Oh honey look... How cute... an angry slashdotter!
You can be sued for anything. Being sued for something doesn't mean that act is: illegal, immoral, unethical, or mean.
That said, many many jurisdictions in the United States have a so-called "Good Samaritan" law. This is a law that protects you from criminal charges and--depending on the state--lawsuits. For instance, the law in Texas is quite broad and protects anyone who acts in good faith from any civil damages. On the other hand, California's law is much more strict, and protects only licensed EMTs, Doctors, Nurses, etc. at the actual scene of an emergency.
Know the law in your state! http://www.cprinstructor.com/legal.htm
Just another "DOJ fascist authoritarian totalitarian bootlicker" -- Zeio
By making data clearly different from executables? I mean, how about "The attachment you are trying to open is NOT a movie/picture/sound/etc. It is a program that has unlimited access to your machine."
Your ad here. Ask me how!